Gate arr orphan deletion on ctime and stop the nightly permissions pass from restamping it — imports preserve the release's original mtime, so the age gate never actually fired for real content

Arrs_Stack/radarr_cleanup.sh

@@ -35,7 +35,7 @@
 # once per run, not twice — classification records which paths are eligible for deletion as
 # it goes, and the delete pass (once the size-threshold check below passes) just acts on that
 # list instead of re-walking and re-classifying the whole tree. That single walk also gets
-# size+mtime straight from find -printf instead of a separate stat fork per file — find
+# size+ctime straight from find -printf instead of a separate stat fork per file — find
 # already has to stat() every entry to know it's -type f, so this is free by comparison.
 # Measured ~130x faster per file (0.033ms vs 4.3ms).
 #
@@ -72,6 +72,9 @@
 #   Files under RADARR_ORPHAN_AGE are left alone regardless of tracked status.
 #   Radarr's import pipeline writes files before registering them — acting
 #   immediately would delete files mid-import.
+#   Age is measured from ctime, not mtime — an import preserves the release's original
+#   mtime, so a file that landed today can read as years old and skip this gate. Depends
+#   on media_shares_permissions.sh touching only entries that are actually wrong.
 #
 # Emby Cleanup Is Part of the Job
 #   Deleting a file without telling Emby leaves ghost entries that show as
@@ -451,9 +454,9 @@ NOW=$(date +%s)
 TO_DELETE_FILE="$TMP_DIR/to_delete_paths.txt"
 > "$TO_DELETE_FILE"
 
-while read -r FILE_SIZE FILE_MTIME filepath; do
+while read -r FILE_SIZE FILE_CTIME filepath; do
     [[ -z "$filepath" ]] && continue
-    FILE_MTIME="${FILE_MTIME%%.*}"
+    FILE_CTIME="${FILE_CTIME%%.*}"
 
     if [[ -n "${TRACKED_MAP[$filepath]:-}" ]]; then
         log "TRACKED: $filepath"
@@ -467,7 +470,14 @@ while read -r FILE_SIZE FILE_MTIME filepath; do
     fi
 
     if has_extension "$filepath" "${RADARR_EXTENSIONS[@]}"; then
-        FILE_AGE=$(( NOW - FILE_MTIME ))
+        # ctime, not mtime — an import preserves the release's original mtime, so a file
+        # Radarr moved in today can read as years old and skip this gate entirely.
+        # Measured 2026-07-27: 400 of 400 files imported that week had mtimes over 7
+        # days, one of them 9613 days. ctime is stamped when the file lands on this
+        # filesystem and cannot be carried in from an archive. This only holds because
+        # media_shares_permissions.sh applies owner/mode conditionally — a blanket
+        # chown/chmod restamps every inode nightly and would peg every file at age 0.
+        FILE_AGE=$(( NOW - FILE_CTIME ))
 
         if [[ "$FILE_AGE" -lt "$AGE_SECONDS" ]] && [[ "$SKIP_AGE_CHECK" != true ]]; then
             log "RECENT (skipping): $filepath"
@@ -491,7 +501,7 @@ while read -r FILE_SIZE FILE_MTIME filepath; do
 # 4.3ms), since find already has to stat() every entry anyway to know it's -type f.
 done < <(
     for host_path in "${SCAN_ROOTS[@]}"; do
-        [[ -d "$host_path" ]] && find "$host_path" -type f -printf '%s %T@ %p\n' 2>/dev/null
+        [[ -d "$host_path" ]] && find "$host_path" -type f -printf '%s %C@ %p\n' 2>/dev/null
     done | sort -u
 )
 
@@ -558,4 +568,4 @@ if [[ "$DRY_RUN" == false ]] && [[ -n "${ARR_CLEANUP_STATS:-}" ]]; then
         >> "$ARR_CLEANUP_STATS" 2>/dev/null || true
 fi
 
-exit 0
+exit 0